CrowdSec Web UI provides a centralized web console for monitoring intrusion detection telemetry, managing firewall remediation decisions, and auditing security events across multiple CrowdSec security engines. Administrators can connect several CrowdSec Local API endpoints simultaneously, aggregating threat intelligence and active bans into a unified visual interface. The dashboard displays geographic origins of attacking IP addresses, active remediation durations, and specific scenario triggers such as brute-force authentication attacks or web vulnerability probes. Operators can search through historical alert logs, inspect raw HTTP request details, and drill down into individual IP behaviors to differentiate authentic threats from false positives. Manual intervention tools let security teams enforce custom IP bans, adjust expiration timers, or immediately revoke erroneous bans across all connected bouncers with a single click. Integrated notification pipelines dispatch real-time security alerts to external destinations including ntfy, Gotify, and MQTT message brokers whenever critical thresholds are breached. Built-in Prometheus metrics dashboards visualize processing latencies, parser throughput, and decision counts over customizable time windows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Leave a fake door unlocked and see who walks through: Krawl is a self-hosted honeypot that poses as a sloppy web server and records everything scanners and scrapers try. Fake WordPress, phpMyAdmin, and admin logins. Every attempt logged, every credential captured. A .env file leaking fake database strings, AWS keys, and Stripe secrets. SQL injection, XSS, path traversal, XXE, and command injection traps that answer with believable fake output. SQLMap gets a different database error on every request. Malicious crawlers wander an endless maze of random links. An optional tarpit adds delay and word salad that cost scrapers time, storage, and tokens. Optional AI-generated pages write a plausible decoy for any path an attacker requests. A hidden dashboard shows an attacker map, top IPs, captured credentials, and per-IP forensics. TLSH fuzzy hashing groups webshell variants into campaigns. A behavior score labels each IP attacker, bad crawler, good crawler, or regular user. Export bans as raw lists, iptables, or nftables rules, with guides for Fail2Ban, OPNsense, and RouterOS. A canary-token link in decoy pages emails you the IP and user agent of anyone who follows it. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Your apps keep using the OpenAI SDK while Antirion, a self-hosted AI gateway, decides which provider answers, what each team may spend, and what gets logged. Clients speak the OpenAI, Anthropic, Gemini, or Bedrock APIs, and Antirion translates between them, so a Claude deployment can answer an OpenAI-style call, streams included. Add providers such as Amazon Bedrock, Vertex AI, Mistral, Groq, DeepSeek, or a vLLM server, then publish them as named Models. Routing rules send traffic by team or project with fallback chains, weighted splits, least-cost or least-latency targets, retries, hedging, and circuit breakers. Budgets and rate limits in dollars or tokens apply per organization, team, project, and key, with projections and alerts before money runs out. Guardrails check for personal data, secrets, keywords, and regex matches, then block, redact, flag, or divert. Exact and semantic caching answers repeated prompts without calling a provider. The request log records every attempt, route, token count, cost, and guardrail verdict, with Prometheus metrics and OTLP traces. An MCP gateway and A2A proxy put tools and agents behind the same keys. Sign in with OIDC, SAML, or GitHub, provision users with SCIM, and review every change in the audit log. Changes you choose can require a change request or a second person's approval, and the Playground sends requests from the console. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Open your laptop in a Lisbon cafe and your files at home answer as if the laptop never left the desk: AnywhereLAN stitches your own machines into one private mesh network with stable names like work-laptop.awl, no port forwarding and nothing exposed to internet scanners. There is no coordination server to trust. Peers announce themselves in the libp2p DHT, identify with ed25519 keys and connect directly over QUIC or TCP with TLS 1.3, hole-punching through NAT and borrowing a community relay only when both ends sit behind hostile firewalls. Send a browser out through the house connection with the built-in SOCKS5 proxy on 127.0.0.1:1066, handy on regional blocks and hostile hotel Wi-Fi. Prefer the full tunnel: the VPN gateway routes every IPv4 byte through a chosen peer, so the whole machine presents the exit node's address to the world. Devices join through invite links or QR codes. Every peer approves its friends and grants exit rights individually, and identity is a keypair you hold, so no account recovery email can betray the network. Manage it from the bundled web UI at admin.awl, script it from the awl CLI, watch it through Prometheus metrics on port 8639, and run it on Windows, macOS, Linux servers and Android phones. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

Anubis is a self-hosted web firewall that stands in front of your website and makes suspicious visitors complete a lightweight challenge before their requests are allowed through. Place it between your load balancer or TLS terminator and the application it protects, with one instance guarding each service. Requests that look like scraper bots are weighed and challenged, which raises the cost of mass crawling so automated harvesting stops being free. Requests that pass are forwarded straight to your target service over TCP or a Unix domain socket, so legitimate visitors reach the real site. You define the bot policy: allowlist known good bots and crawlers you want to keep, challenge the ones you are unsure about, and turn away the rest. Challenge difficulty and weight thresholds tune how hard visitors must work, letting you balance protection against friction for real readers. The server listens on port 8923 by default and exposes Prometheus metrics on port 9090, so request and challenge rates show up in your existing monitoring. Deployment is a single Docker image or native package with minimal resource needs, and configuration arrives through environment variables plus the policy file. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Viewers arrive on browsers, phones, and desktop players, and SRS meets each of them with the right protocol from a single published stream. A broadcaster pushing RTMP can reach browser viewers through WebRTC with sub-second latency, phone apps through HLS, and desktop players through HTTP-FLV, all from the same live source without running parallel encoders. WHIP endpoints accept WebRTC ingest from browser studios and tools like OBS, while WHEP serves WebRTC playback, so an entire publish-to-viewer path can stay on modern web protocols. Operators shape each channel with virtual hosts, authenticate publishers and players through HTTP hooks that consult your own backend, and record live streams to disk as DVR archives for replay. Forwarding republishes a stream to YouTube, Facebook, or another SRS instance, and origin clustering lets edge servers pull from a central origin so one ingest feeds viewers in several regions. The built-in HTTP API reports streams, clients, and server health for monitoring, and GB28181 support ingests surveillance camera networks alongside creator broadcasts. Configuration lives in a single reloadable file, so changing a vhost or enabling HLS rarely means restarting the listeners your audience is attached to. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

MediaMTX sits between cameras and viewers as a self-hosted live media server, taking in video and audio streams over one protocol and handing them back out over another, so one IP camera feed can end up playing in a browser, a phone app, and a recording archive simultaneously. Publish with FFmpeg, GStreamer, OBS Studio, a browser, or a Raspberry Pi camera over RTSP, RTMP, SRT, WebRTC, Media-over-QUIC, HLS, MPEG-TS, or RTP, and read it back on any other protocol without a transcoding pipeline. Run dozens of camera feeds side by side, each on its own path, and keep every path available even while its publisher is offline. Record everything to disk in fMP4 or MPEG-TS as it streams, then play recordings back later through the same server instead of shipping files around. Authenticate publishers and viewers with built-in users, an external HTTP check, or JWT, and use the control API plus Prometheus metrics to wire the server into the rest of your monitoring stack. Forward streams to other servers, proxy cameras behind NAT, and fire hook commands whenever a client connects, publishes, or disconnects, so a doorbell camera can trigger a snapshot or an alert as it starts streaming. Reload the configuration while clients stay connected, and tune everything from the same mediamtx.yml file or environment variables, with no database or runtime dependencies to babysit. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Instead of wrestling with raw command-line flags and YAML configuration files for every device on your self-hosted Headscale mesh VPN, Headplane gives you a Tailscale-style web administration console to manage machines, users, DNS records, and access policies from any browser. From the machines overview, network administrators can inspect connected nodes, view Tailnet IPv4 and IPv6 addresses, rename devices, reassign ownership across users, toggle key expiration, and approve advertised subnet routes or exit nodes in a couple of clicks. Built-in Access Control List (ACL) management lets you edit security policies, define user groups, assign node tags, and configure auto-approvers without manually SSHing into your control server. When someone needs immediate shell access to a remote Linux host on the mesh, the integrated WebSSH console opens an interactive terminal session right inside the browser tab over Tailscale SSH. You can also manage MagicDNS settings, configure split DNS nameservers, and add custom DNS records that automatically reload your Headscale instance. Multi-user administration supports OpenID Connect (OIDC) single sign-on with identity providers like Okta, Authentik, Authelia, and Google Workspace, alongside granular role assignments and pre-authentication key generation for unattended server enrollment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

To protect self-hosted web services behind a unified single sign-on portal without deploying complex enterprise identity suites, Tinyauth acts as an OpenID Certified authentication server and reverse proxy middleware. Homelab operators and infrastructure teams place it in front of internal dashboards, media servers, and administrative tools routed through Traefik, Caddy, Nginx, Nginx Proxy Manager, or LinuxServer SWAG. Users can sign in with local bcrypt-hashed credentials, scan QR codes to enroll time-based one-time password authenticators for two-factor verification, or authenticate through external OAuth providers like GitHub, Google, and Pocket ID. Organizations running centralized directories can bind Tinyauth directly to an LDAP server such as LLDAP or OpenLDAP and automatically synchronize group memberships for role-based authorization. Fine-grained access control rules configured via dynamic Docker container labels or environment variables let administrators whitelist or block specific usernames, OAuth email regex patterns, OIDC groups, client IP CIDR ranges, and URL path prefixes per subdomain. For applications that support native federated login, the built-in OpenID Connect 1.0 discovery endpoint, authorization code flow, and userinfo API allow seamless single sign-on with optional consent skipping for trusted clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

zrok puts services that live behind NAT and firewalls onto the public internet with a shareable URL, without opening a single inbound port. The machine being shared dials out to an OpenZiti overlay network, so a web app on your desk, a Raspberry Pi at home, or a staging box inside a corporate network becomes reachable through your instance while its firewall stays closed. One command shares an HTTP service publicly; add a name from one of your namespaces and the URL stays stable even when you move the backend to a different machine, and an ephemeral name can be promoted to a reserved one when a quick demo turns into a keeper. Private shares skip the public internet entirely and reach only the users you grant, including raw TCP and UDP services, while web and drive backend modes publish static sites or whole folders, with OAuth, password auth, and an interstitial warning page available on public shares. The long-running agent keeps every share and access under one process, restarts the named ones after a reboot, and offers a localhost console for point-and-click sharing; the account-wide web console maps your environments, shares, and accesses as a navigable graph or a sortable table with live activity. Operators get invite-based accounts, InfluxDB-backed usage metrics, and configurable limits that warn or cut off accounts that exceed their quotas. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Give every laptop, server, and cloud VM you own one private address that works from anywhere, and that is exactly the overlay network Nebula builds. Each machine runs a single small binary, presents a certificate signed by your own certificate authority, and joins a peer-to-peer layer-3 mesh where tunnels form on demand between hosts that need to talk. Lighthouse nodes, the piece you park on a VPS, keep track of where every peer can be reached and introduce hosts to each other, so machines find each other without any central VPN concentrator carrying their traffic. UDP hole punching and keepalive packets open direct tunnels through home routers and office NAT, and when two hard NATs refuse to cooperate, a relay host forwards the encrypted traffic until a better path appears. Every host enforces its own firewall, default deny on all overlay traffic, with rules keyed to certificate groups, so laptops in the user-endpoint group can reach a server's web port while other groups cannot. Ordinary hosts need no inbound ports at all, and the same binary runs on Linux, macOS, Windows, phones, and FreeBSD, making the mesh feel identical at home, in a datacenter, or across three clouds. Unsafe routes can even pull an existing office subnet into the overlay, giving legacy hardware that will never run Nebula an address on the private network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

FCaptcha guards your forms with an invisible check that spots bots, headless browsers, and AI agents steering real browsers, all from a server you run yourself. Drop the widget into a signup or contact form and it quietly watches how the visitor actually behaves: pointer movement, typing cadence, scroll shape, and dozens of other signals that separate a person from a script. Vision agents that screenshot and click, and computer-use agents driving a browser through automation protocols, leave input traces the scoring engine catches. Self-declaring crawlers get flagged by name, and signed agent requests are verified cryptographically so polite, identified bots can be allowed while anonymous automation is blocked. A proof-of-work challenge adds a liveness gate behind the scenes. Humans see no puzzle at all, in any of 34 languages, and the widget meets accessibility standards for screen-reader and keyboard-only visitors. Your backend verifies each token through the same siteverify contract that Turnstile, reCAPTCHA, and hCaptcha use, so switching providers is a change of address rather than a rewrite. No cookies are set, no visitor data travels to a third party, and nothing phones home. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Open Compute is a self-hosted Cloudflare Workers-compatible platform that runs your Workers, storage, and AI services on hardware you own, from one binary and one daemon. Deploy the Worker code you already wrote with its config file and framework adapters, then roll back to an earlier immutable deployment when a release misbehaves. Serve traffic locally or over HTTPS through the shared Gateway, with routes you control instead of a vendor account. Each instance stays isolated with its own data directory and credentials, while you switch between registered instances from the same operator view. Bindings cover the platform pieces applications actually need: key-value data, SQL databases, object storage, stateful objects, queues, durable multi-step workflows, scheduled cron, cache, vector search, and AI search. Logs and a live tail show what running Workers are doing right now, and health, backup, and recovery workflows keep a single machine manageable without a cluster. Verified upgrades roll back automatically when something fails, and object bytes can move to S3-compatible storage when local disk is no longer enough. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Tools and applications that already speak S3 can use RustFS as their storage backend, so backup jobs, data pipelines, and services keep working while the data stays on infrastructure you control. A built-in web console on port 9001 manages buckets, object uploads and downloads, access keys, users, groups, and IAM policies, with a status page for cluster health, capacity, and scanner activity. Versioning, Object Lock retention, bucket quotas, and server-side encryption with Vault or AWS KMS backends protect objects once they land. Lifecycle rules expire or transition data, and tiering moves cold objects to remote targets such as Amazon S3 or Wasabi. Bucket replication and site replication keep clusters in sync, and event notifications call webhooks when objects change. Single-node mode suits a lab or small server, while distributed mode adds erasure coding, bitrot protection, background healing, and pool expansion or decommissioning as capacity grows. Sign-in works with local users, OIDC single sign-on, or OpenStack Keystone, and FTPS and WebDAV are available by default, with SFTP and the Swift API as opt-in builds. A preview of S3 Tables exposes an Iceberg REST catalog for tools such as DuckDB and PyIceberg, and a documented migration path moves existing MinIO deployments across. Typical uses include backups, container registries, logs and traces, data lakes, and AI training sets. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Where Traefik's built-in dashboard only shows what is running, Traefik Manager lets you change it: add routes, middlewares, and services from forms and wizards instead of editing YAML by hand. A first-run wizard connects to the Traefik API, creates a route for the manager itself, and sets the admin password. After that, the dashboard turns every route into a launchable app card with live health, and the Route Map draws each request from entry point through middlewares to backend. New routes use a slide-in form for HTTP, TCP, or UDP with several domains and backends, sticky sessions, and health checks. 30 middleware wizards handle authentication, rate limiting, headers, CORS, and redirects, and weighted, mirroring, or failover services can be built on their own. For day-to-day monitoring, the Certificates tab tracks expiry from acme.json, the Logs tab turns the access log into clickable analytics, the CrowdSec tab lists attacks and bans, and alerts reach Discord, Slack, ntfy, Telegram, and more. Changes to traefik.yml apply with a one-click restart, every edit is backed up locally and can be pushed to a git repository, and a lightweight agent brings remote Traefik servers into the same interface. Sign in with TOTP two-factor or OIDC single sign-on, in any of 14 languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Behind one admin panel, DefGuard runs a WireGuard VPN, an identity provider, and multi-factor authentication, so every person and device proves who they are before reaching your private network. Administrators define VPN locations, assign which users and groups may enter each one, and enforce firewall rules that allow or deny traffic per location, with changes applied to gateways in real time. People enroll remotely through a guided self-service flow, register their own laptops and phones, and connect with desktop and mobile clients that show live connection statistics. Sign-in goes well beyond passwords, because the built-in OpenID Connect provider gives internal tools single sign-on, while TOTP codes, WebAuthn and FIDO2 keys, email tokens, and mobile biometrics gate each connection. Directory teams sync accounts from LDAP and Active Directory, or federate sign-in through Google, Microsoft, and custom OpenID providers, instead of maintaining a separate user list. Every authentication, enrollment, and policy change lands in a searchable activity log, and webhooks plus a REST API let surrounding systems react to access events automatically. Gateways keep enforcing access from a local cache when the control plane is unreachable, and several gateways can front the same location for failover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

One OpenAI-compatible endpoint, 1,600+ models behind it: Portkey Gateway sits between your app and every major LLM provider, deciding in real time where each request should go. When a provider times out or returns errors, automatic retries with exponential backoff kick in, and fallback rules quietly move traffic to your second-choice model before users notice anything. Load balancing spreads calls across multiple API keys and providers by weight, conditional routing sends each request down a different path based on its content or metadata, and per-request timeouts cut off providers that hang. Guardrails inspect inputs and outputs as traffic passes through: block banned words, screen for sensitive content, and enforce the checks your compliance team asked for, with dozens of pre-built rules ready to attach. Text is only the start: the same API shape reaches vision models, speech-to-text, text-to-speech, image generation, and realtime websocket APIs, so multimodal features stop multiplying your integration work. Routing policies live in JSON configs you attach per request or per client, which means experiments, cost controls, and provider migrations ship as configuration changes, not redeploys. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Game servers, home labs behind carrier-grade NAT, and services that need a presence in another region all end up needing the same thing: a cheap entry machine that forwards traffic to the real backend, with rules you can change without opening an SSH session. Relay Panel is the control room for that job, a self-hosted web panel that runs TCP and UDP forwarding across a fleet of lightweight relay nodes from one dashboard. Each rule can fan out to multiple targets with failover or round-robin balancing, follow domain targets as their DDNS records change, and pass the real client IP onward through PROXY protocol, even when relays chain through other relays. Per-rule concurrency caps, scheduled restarts, and automatic target circuit breaking keep one bad upstream from swallowing the whole route. A built-in shop lets users buy plans and top up balances with redemption codes while quotas drain by measured upload plus download, multiplied per line, so premium routes cost more by design. Traffic charts split the last day, week, or month by line, the node page watches CPU, memory, and connection counts, and Telegram or email alerts fire the moment a relay drops offline. Nodes upgrade from the panel in one click, and the first login forces a password change before anything else opens. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.